Weakness (CWE)
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
More detail
Although this weakness can occur with any type of resource, it is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as "/tmp" or the current working directory.
In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path, the function follows a search order that includes two path elements that might be uncontrolled:
- the directory from which the program has been loaded
- the current working directory
In some cases, the attack can be conducted remotely, such as when SMB or WebDAV network shares are used.
One or more locations in that path could include the Windows drive root or its subdirectories. This often exists in Linux-based code assuming the controlled nature of the root directory (/) or its subdirectories (/etc, etc), or a code that recursively accesses the parent directory. In Windows, the drive root and some of its subdirectories have weak permissions by default, which makes them uncontrolled.
In some Unix-based systems, a PATH might be created that contains an empty element, e.g. by splicing an empty variable into the PATH. This empty element can be interpreted as equivalent to the current working directory, which might be an untrusted search element.
In software package management frameworks (e.g., npm, RubyGems, or PyPi), the framework may identify dependencies on third-party libraries or other packages, then consult a repository that contains the desired package. The framework may search a public repository before a private repository. This could be exploited by attackers by placing a malicious package in the public repository that has the same name as a package from the private repository. The search path might not be directly under control of the developer relying on the framework, but this search order effectively contains an untrusted element.
How to prevent it (5 mitigations)
-
Architecture and Design, Implementation
Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
-
Implementation
When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
-
Implementation
Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
-
Implementation
Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory. Since this is a denylist approach, it might not be a complete solution.
-
Implementation
Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of finding the program using the PATH environment variable, while execl() and execv() require a full path.
Source: MITRE CWE-427
952 results · Feed
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.
-
High 7.8
DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated att…
-
High 8.4
DLL Search Order Hijacking in ESET products for Windows
DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code.
-
Medium 6.5
Linux::Statm::Tiny for Perl allows untrusted code to be included from the current working directory
Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended fi…
-
Medium 6.5
Sub::HandlesVia for Perl allows untrusted code to be included from the current working directory
Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended fil…
-
Medium 6.5
Mite for Perl generates code with an untrusted search path vulnerability
Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, poten…
-
High 7.3
Visual Studio Code Elevation of Privilege Vulnerability
Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
-
High 7.3
Visual Studio Elevation of Privilege Vulnerability
Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally.
-
High 7.1CVE-2024-10930 Public exploit
Carrier Block Load Privilege Escalation
An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated privileges.
-
High 7.8
Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation.
-
High 7.0
Blizzard Battle.Net profapi.dll uncontrolled search path
A vulnerability was found in Blizzard Battle.Net up to 2.39.0.15212 on Windows and classified as critical. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to uncontrolled search path. The attack needs to…
-
High 8.5
IBM i privilege escalation
IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.
-
High 7.3
Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulner…
-
Medium 5.8
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data
An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac
-
Medium 6.8
Local Privilege Escalation in Rufus 4.6 and previous versions
Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attacker loading and executing a malicious DLL with escalated privileges (since the executable has been g…
-
High 7.3
Insecure Loading of Dynamic Link Libraries in HVAC Energy Saving Program
Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose information or execute arbitray code on affected systems. This issue affects HVAC Energy Saving Program:.
-
High 7.3
Insecure Loading of Dynamic Link Libraries in USB-CONVERTERCABLE DRIVER
Insecure Loading of Dynamic Link Libraries have been discovered in USB-CONVERTERCABLE DRIVER, which could allow local attackers to potentially disclose information or execute arbitray code on affected systems. This issue affects USB-CONVERTERCABLE DRIVER:.
-
Medium 6.7
Uncontrolled search path for the FPGA Support Package for the Intel(R) oneAPI DPC++/C++ Compiler software for Windows b…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an a…
-
Medium 6.7
Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authent…
-
Medium 6.7
Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) …
-
Medium 6.7
Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an auth…
-
Medium 6.7
Uncontrolled search path for the Intel(R) XTU software for Windows before version 7.14.2.14 may allow an authenticated …
-
Medium 6.7
Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow …
-
Medium 6.7
Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may all…
-
Medium 6.7
Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authent…
-
Medium 6.7
Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to po…
-
Medium 6.7
Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially …
-
Medium 6.7
Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family befo…
-
Medium 6.7
Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to poten…
-
Medium 6.7
Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authentica…
-
High 7.3
A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an atta…
-
High 7.3
Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
-
High 7.3
Visual Studio Installer Elevation of Privilege Vulnerability
Visual Studio Installer Elevation of Privilege Vulnerability
-
Medium 6.7
A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example s…
-
High 7.8
Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. Th…
-
High 7.3
NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a mal…
-
High 8.5
Local privilege escalation in FlexNet Publisher
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unauthorized, locally authenticated user with low privileges can potentially create th…
-
High 8.6
Uncontrolled search path can lead to DLL hijacking in USBXpress Win 98SE Dev Kit installer
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.